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TN THE CLAIMS: 
Pending claims follow: 

1 . (Previously Amended) A method of reconstructing a session using a first analyzer coupled to 
a second analyzer and a data collector, the method comprising; 

performing session reconstruction o3i packets received at a first analyzer; responsive to 
successful session reconstruction on the first analyzer, sending a first message to at least one of a 
second analyzer separate fi-om the first analyzer and a data collector, the first message corresponding 
to session data; and 

responsive to unsuccessful session reconstruction on the first analyzer, sending one or more 
messages to the second analyzer; 

wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer which are unrecognized, and the second analyzer recognizes 
the unrecognized packets to successfully reconstruct the session. 

2. (Cancelled) 

3. (Previously Amended) The method of claim 1, wherein the one or more messages Grom the 
first analyzer to the second analyzer further comprise hints generated by the first analyzer. 

4. (Original) The method of claim 3, wherein hints for a packet comprise a time the packet was 
received and an address information for the packet. 

5. (Original) The method of claim 1, wherein the packets received at the first analyzer are 
output from a filter for controlling which packets in a plurality of packets flowing into the filter reach 
the first analyzer. 

6- (Previously Amended) The metliod of claim 1 , fiirther comprising: 

performing session reconstruction on the one or more messages received at the second 
analyzer. 
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responsive to successful session reconstruction on the second analyzer, sending a first 
message to at least one of a third analyzer and the data collector, the first message corresponding to 
session data; and 

responsive to unsuccessful session reconstruction on the second analyzer, sending one or 
more messages to the third analyzer, the third analyzer also receiving one or more messages from a 
fourth analyzer. 

7. (Original) The method of claim 1 , wherein the one or more messages from the first analyzer 
to the second analyzer comprise summary of packets received by the first analyzer and one or more 
hints generated by the first analyzer, 

8. (Previously Amended) The method of claim 1, further comprising performing session 
reconstruction using the second analyzer on the one or more messages received fi^om the first 
analyzer and the one or more messages received from a third analyzer. 

9. (Original) The method of claim 8, fiuther comprising sending a second message from the 
second analyzer to the data collector, the second message corresponding to session data. 

10. (Previously Amended) A system for reconstructing a session, the system comprising: 

a plurality of packet sources, each of the plurality of packet sources generating a plurality of 
packets; 

a plurality of separate analyzers, each of the plurality of analyzers coupled to a packet source 
in the plurality of packet sources, each of the plurality of analyzers for session reconstruction on 
respective packets in the corresponding packet source, at least one analyzers sending a first message 
corresponding to session data for reconstructed sessions to a first analyzer and a second message for 
unreconstructed session data in the respective packets to the first analyzer, 

and wherein the first analyzer responsive to receiving messages fi-om at least one other 
analyzers attempts session reconstruction using the messages; 

wherein the second message comprises packets received by one analyzer which are 
unrecognized, and the first analyzer recognizes the unrecognized packets to successfully reconstruct 
the session. 
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11. (Cancelled) 

1 2. (Previously Amended) The system of claim 1 0 wherein the second message further 
comprises hints. 

13. (Original) The system of claim 10 wherein the second message comprises summary of 
respective packets and hints. 

1 4. (Previously Presented) A method of reconstructing a session using a first analyzer coupled to 
a second analyzer, the method comprising: 

performing session reconstruction on packets received at a first analyzer; and 

responsive to unsuccessful session reconstruction on the first analyzer, sending one or more 

messages to a second analyzer separate from tlie first analyzer; 

wherein the one or more messages from the first analyzer to the second analyzer comprise 

packets received by the first analyzer which are unrecognized, and the second analyzer recognizes 

the unrecognized packets to successfully reconstruct the session. 

1 5. (Previously Presented) The method of claim 14, wherein the one or more messages from the 
first analyzer to the second analyzer further comprise hints generated by the first analyzer. 

16. (Previously Presented) The method of claim 1 5, wherein the hints comprise a time when at 
least one of the packets was received and address information for the packet. 

1 7. (Previously Presented) The method of claim 14, wherein the packets received at the first 
analyzer are output from a filter for controlling which packets in a plurality of packets flowing into 
the filter reach the first analyzer. 
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